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ff 1 1 



- ft & & & ft t ^ * ^ £ -n & ' #> A"* tf! Bfr « 
51- ^ it illtt ^.^tt ' Jfr>S&*-3r£-dtft*#l-# 

* 48 *t * i^Llf ' it * iL - <M *r 

a m n # * * 'i a «. * «■ * «t * * a * ° ****** 
• * # & w - 

S30 ^ 

S32 :5t iL S f # ^ S # 

S34 A. n * s£ 4f ^ at ft * # : 

S40 jft . 



A method for searching Peer-based security 
pol icy database ( SPD) exploits the peer-based 
property of the Internet security policy database. 
The;. original SPD is divided into several smaller 
ones, a Peer-based catalog is established 
corresponding to the peer-based SPD. The method 
according to the, present invention can 
advantageously reduce searching time. 
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ffl 



i-#W«LW (1) 

[ % m m M *- & m 4i ] 

& m. A 51- (Virtual Private Network; VPN)^#'J 
ffi m B£ 1WS ift ^ ( I n t e r n e t Protocol; I P ) tf) %L #f ' t A- 
m f& m -b #J >fa ^ si it. (tunnel ing)^ ^#«IW5-«fS^-L^ 

^ " Uf - h xg. . i$ m *&- $ ft m it # m j& m il ft.' > m & 

ft % & M & M ^ & m m m & 4c & & i& & ("IP Security 

)>$" ^ ' 03 Bfr*flSfc-4c-£-ii*li& ^ M ^ T (encryption)^ 
*& «■ (authentication) - ^ ^ ^ W. (key management ) - it 
& (digital certification) # 4c ^ # ^ ' * # * £. 

; # #! ffl *S l& »i ^ 4r £r it «L . & Jfc ft 4t t # # i£ >3r ' * # 
##r ##^ 1^3 "^^^ ft 1*3 ^ 3£ (inbound processing)^ 
ft *b ■ M. & (outbound processing) 0 !^ A#f 
m 3& (peer net) - £fr M St (peer gateway) .» it J. 4^ 

*fc W'SJi ( local gateway) » ft & #J *b « *&■ (local net) : 
i€a 1*3- A 3£ $'J #J M & (packet)f I; ft J*3 M & (inbound pa- 
cket)' ft ft £j- & ^ pfc 3* ' — ^^^^^1^-^^-^^iitfL 
1fijfc!i|3EiattftrtlHI!fr«^4r£-ii-ifl.1&;t-itfe ( inbound 
IPSec packet )■ » %r--#.Jk-$-3&#itiiftimffrmf&18ijtM& 
( inbound IP packet) • « ^ '• S& 
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i - qtWULW (2) 

i ffl it • it 5. # # M it ' * & fJ 4N- # «' ^ : ft ft & & & 
§>f#j £f & (packet )# & ft *b M ( outbound packet)' % 
- & fa ft m m mfe tih M tL (outbound IP Packet) • 

^H^^flrilMtttf^^^ (transport mode) 

# ilj it $ ( tunne l iode)^ t ^ I^J 6{j I ^ ' # $w & & %o 
3L tikitt 2. *l. (host-to-host )tfj £1 It ^ *J ' # 4 tR. #J 
3= ^ - £#1f'flF«Rfr*li&4r£- ii. sfL i& ^ ^ # Ifr 4* ^. ; *i * 
^ sfc JI'J A M it * M it (gateway-to-gateway M M it ft i & 

(gateway-to-host *fc *l ' * * M 3t & £ * # '* # 

m m as- * it «i $ 4^ it it m & t ° ^ «& » — £ 

it « * ' ffl it X m ^ ft it it * * ' * *:"«"- at ^t^itf 
4* £ - « * # .* M it ^ ^ Jl i a it m • 

' SS- ■ # it «. i& &L f& # ^Irilf 14 

* t, ' # Jfc # « »8- to fct ^ # 3£r 1& ^ ^ # * ( Port Number 
) f$ it i£ # ' * £ * *f & %l % & ft.M & & #J > j|. Jl. #j 
3" & & 1T 3fc (apply) «q I* m & * *i tfl. i& ^ - «*i *& (by- 
pass) «i Rfr ^ si- 4? ^ it m 1ft ;t ^ J: & * ( discard)' ft 

Jt j|j '3S ^ k & X ^ * M & ° J-^^-^^^I^^ISlr^^it 

«L m ^ ' f ffl.Hf ^^tl^tf ( Security Asso- 

ciation Database ; SAD )t ' * & m Mr m n- * ^ Si: «l 1A £l 

^ M A . - « to m Q- * ^ it m ^: # tt- ^: - «fit « * • ^ 

^4 ^ >^ * & ^ ^ * ft «. ° 

^^I'^ffl i u t « ^ ^ ^ ^ ^ t m ^ ^ ^ f& 




# 5 X 



(3) 

s!t" - • *fr t£ # 3r s£ - ^.^3tA.*i*il3JtA.iN-:|L - Bt. J* « * * 

i **■ # *. ° ®$b^mtfj&mn&. - '£ w mm - ifc « a * 

& 2r; iC *j- i& £1 ^ is) -3r ^ A ft ° it # ^ 15] &!j ^ t «t & 
^T:-'ll8*^^JfLf^* (■ Security P ojl icy Database: 
SPD)i£ 4f # t * a • 

# ^ m #) $ H (ordered list)- titlf^tt^l^ 

# If! it 4* # (selector)^ #4 it ' II it .4* & T *■ S» #l *t 
(source address)-- S#4it*L( destination address) > 

# tft £ (protocol ) > #. Sfc ifc •( source pqr t )£* A. B # a* 
(destination port)' ffij, J. # #1 $ it # # .« -"^ . <fe 

'fa (single) - la ffl (range)i # ffl 3= it ( wji 1 dear d) » 

; * ^ ti: it # # ^ ^ is) ' m & &l% f*\ *t # ^ a £ i 

# 6tfi 'It ^ . ' *P & 3r A ft f * t ' ^T^**f«i^t 
ft #j II it i$ # IS] s$ ft & - m M & & * Jfc I- * *4 * * ^ * 
>jc - j a jfc ' ^BfriW12&.^^i£tflt&^:£&^^^'£fcft1t-*l4# 

#j i; «o 21 * * * # ^ # m m 4& «. '# ' ,-Jl fj a fj ft - ^ 

*H #^ W Aft A i ' « 3£ # - '14 # A W *k • 
!ft-HV>*&*^iifcft*##'P*-H ffi & ) ° 

# Jl; 4£ W-tt. 4t 4 t<J '( linear search ^It^^^If 

# ^ ift 3r & » £• b£ K| # A (time complexity )|, 0 ( n ) • n 
^ 4 I t @ • »»itjlttift^«l*tt ' & '14 4 * ^ A 

ftt'^j^w^jsfe^^i^^^^^^iftia^iia^^ss ° @ 
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(4) 

«fft 3r .ft it f -fr 100a T ' t A ^^1 ffl 11 ft ft * 

i o o p » « a. m & * « *t ft m « i o o o o • 

J= : — 3ft & * # -ft (brute force parallel)-^ ^ 

iil'f : — * Jb £f & ^ (Flow-based)^ ^ ^ 

ft it'®- ft * (A a # *J ft 6, 347, 3 76 - *J 4- ft 

2003/0023846** 2 0 0 3/0 0 6 9 973 )' ifr RR ft — ifc : 3 - * 
& ® s£ (PATRICTA-based . )■£■ £r at ft t 34 *4** (A 

S * ft 6 347376** #L * #i .-fr ft -20 0 3/ 0 0 61 6 0 7 ) ' tf 

: ft *. * -"afc -it # •#* * * ^ & a % *j A * + 

4t ^ : S" #j # '14 ' 4* 4* & * #J i& ft *t.* ; Bfr 

|f;if 4 & & il4S^tAtItif > ik li % %r Ik M. 

# 4?: afc ft t f4 # & fe. - * »tb ft ft *t & sfc ft *b *f & W 
4f £H ft = f * A * ' * iifc ft 3S * ( pol icy lana- 
ger^f t f S v4* H ^ AT/it t 

5f *4j £ . ; ^ ft *b M & ^ A ft * *4 * ' ft ^ A *o ^ ' 
ife.EwftiKdJte'^.^iifcft^a*'- ^ % $3 m a _L & ■ &L ft 

^ 44 £1 # ^ # fr #J «fc ft ' afcft^3£"*K-rsS#*» 

# & 4K tf'itfc ft ^ -L % • 

; »fcb 2r * *fett A & . * *fc i% @ J*> « # . «. *L £ #1 4f iSfc ft 

t n # « & > 3. & x m m &f jkl i& ^ -fsi * ^ ft t ^4 * i 

*0 #1 ^ » sp - ^ 1*3 m H &. ft t ^ * 4 - ^ i^j ?b 
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(5) 

" : # k Sft * * A «. * # * * * ♦ *t * * - « ^ & ^ L 

#-:*I^J4t ° a # 4fr & #J t& & ( Transport. Control 

Protocol; TCP ) £f & iM?'J ' * * 4a. I^J 2* * § # to 

^;^c If ^4 ' a # i'Hi f I ^ it I ' ^ i& itt ft & it m- 

4 *. #t # & * « 13 - -as m & >ft w * & m ; a ffl ° *» * 

4$ tt*#afc-^-^B-^ ffl ffl # * ^iS - -f 6(i * 

hash table)' 3g 1ft- _t b£ ft 41 3fc & * 0 ( 1 ) °. 

& ft. 'It «■ £ ffl * ^ # it 

Hfc i ' & £ ..'W 4£ # ( s p ac e complexity)^ 0(f)' f 
% M & 3Sl # ti 0 # *b ' jfc^T*6«i*-'ffl-#e,4fe $ ft # & 

.'1-4 1^ i 1 1 ;f4 I •■- 'a >tb -*s ♦ & M ft. Mm n- m & 
& 3t; jl & & ^ t £ ♦ • a % * - -& it ^ ffl- ° 

' j0L * © * * £t & If * * i « * «. ffl * * S » (PATRI 
-CIA Tree)itt^j fi|4 ' fa f- © # - « — ^ «fc # «■ 5* * 

( binary searching tree algorithm) 0 ^ ^ 4a HP © 
( non-contiguous raasks)^ ^ ^ ffi t ^ f If 'It )^ ( worst 
case)^ 0(w2) ' wJb & * Si * 4ft * (key)# -fc £. ° « £ "H * 
*I -# % 2 0 0 3 / 0 0 6 1 5 0 7#j 3" % fr\ • w£ 112° Jfl & # © 
sS, 4ci at I. * *4 * i to & JO; >fe ^ . » ^ l 5 ^ ^'J #r # sfc 
I ft ft at E ^ jfe's: 4a 4 4 A ft ■# ^ - # ■* *t ^ 

^ ' % & $L m M & # 4r ^ St fH f # * # 4* j& ^ J'll ^ -14. ( non 
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3L»*M«>fl (6) 

-ordered )ft 4r ^ afc jfL t *4 * ' WilM^IUnfH 

«" i# ! « & it m 1ft £. m # W "01 # '14 ° -fa A i it #f «: * 

60 & 4tt 2r * « £ xSL * — # ■ & A # * * & ^ H * ** * & & 

« * ) ° *r ^ ft *b m i^- $i t& ^ *r & ( s i o ) • & fi- " -Sr 

sks fk it M- #j 4 *d:( SI 2) ; *»*4"*)*£**:iL # * * 

jh jl> & * * ( si i ) ; *i * 4 n & A a* i& as *r*s- 

4r ^ 31 "tfL 1ft Jt ' I'J it A * WS- « 1ft )t 4« (SI 3) ; *» ^ 
ItMllf^^H^^^^i^tt ^. ' M # 4 ^ 4? £r ift 
tkt-ft& ( S 1 5 ) ; -kP * >JL * 4 £J •.*'] & » it 5t A- * 

£r ift: ifc -(S14) : *>^lil'J ' H'J M JR. (encapsulation)^ 
& Si ( S 1 6 ) ; # it. 4t to & (encryption)^ tS ^ ( authenti- 
cation)*//^ (S17) ; 0, Ak. it ^ Hi ff- m ®? 1ft Jt.#J & (S13) - 

ffl #r ) ° ^^j^rt#ii^««S-4f^Ji.«.1ft^^fe ( S 2 o ) ' ji'j 

*Ai4*)-4?£r1ft*'ir#1-*'(S23)' *» * iSL * * *I (S22) > ft'J 
^ M M & » ^ * 4 $'J ' ■ & • sfe # - * (decryption)^ mm 
ft tfj' (S2 4) ; # # & It ( decapsulation)^ £M# (S25) ; 

% ' 3t^^4ri^ If 34 # ¥} 4 "HJ ( S26) • *r ^ ft ft «q 
« 34 1ft £ £r ( S 2 1 ) ' B«JjL*5fc4r*^iSfc|L-!f*l-*«j4«J 
( S 2:6 ) • * n&. f. f # * 60 4 m ' * 4 M A #k « 60 • 

ji'j 4 & * * & ( s 2 2 ) ; *o*'4£]jE.*fc#i&jfc ' m it 4f *8 

Hfr ffg Sir 1ft ^ 60 -4 -38 (S27) - , 
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(7) 

[ &<m & 1 

|«. # a # ^ 

I ^ * 
I a ft' t # * w 
• # 

ffl at! ft « If *t 

5^ S ; If: t 0 
- 4R; # $ f$ #J 
I at ft! * ^ * • 

I dH ii ffl. ift 
& &\w # -*r M 

& ° i 

| iii m ts 

#: * «• 

I at ft t «■ 



@ tt*.* 4" ****** *-4*l* ° 

- # ft ' # B ^ *fc 4jt *fl I* « W ^ ^ it ^ ^ ^ 

».j*.#3Htt*4***tt* y > « A £ 4* * * 
at ft f # * ' ititA-'lffl# i ii*I##^.4f^ 

«■ $ & a ** ' ^ # a at :ft b# h ° 

^ 3 - # St ' *■ # B £ * 4 "*J at ft ^ ' . ♦ #»J 

# Jbt - 8 # to *L 4 4 # M # 

^ t # ^ a t t ' # ^ ^ ^ * # ♦ * M 

m, .» it 4® *h # til #J ^tf li - # s£ * ^ 

m 3l % — # » ' # B ^ j& ffl ^ 6 .ft £f & ' 

Rfr m & & £r il*H&Jfc&-3£ii6<J-6j « Bfr « *fc- 

# a ' A # it #j ft ft'*!Bfr**«fc-1&i£^'& : ' 
ffl £ ft *b *f & ' # . ft *h «. f& m %. M 



# a/i ^ # - # .it ' # a £ A ffl . * « ,i» « * 
£ ^ it it & A ; #Titi&.^^^^tm^ t 

* 4 «d & M & m. ^ # it at ft * * 4 «a ■ * *■ ^ 



C * ^ ^ 1 
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a. (8) 

ft £1 M 5& &} J8L ' 1 ^ it i| t ^ i t 8^ f I- 

• - m ft- " «. SB- 4f it it m t& & si. at T * ^ * #i ^ W 

it (originating gateway)^ — IS *f -it M it ( terminating 
gateway)^ 4 ^ #} it it • #L ft £P *3 S&- (internal network 
/Local Area Network; LAN ) # ^ # i£ # ft *h *f & 

*&' ffl it H3 l& «3 £r it SR. i& 3S 41 ' tti»i-l 

*h 3p' ft Jl (outer h e a d e r ) • it >f *b ^Mf ft . *- * to fct & ^ 
W it| # it ' § ft >fiL it I'J £f at ffl it 6d iSL bt ' itb B$ g- jt ffl 
it *j ■ M it 6t # # W it - 

\ & ' jt' ffl dt-*! jkf *£ * 

^ * it ^ * ft ^ m #) ft ft M fe. ° £-*f jfc .M it ^' fe- *s » « 

»&• 4r it tTL 1& £ #J ^ ti ft #'] 41 ' it tff.^fr & ;t t t # i& 

$«j £ : jl &) a # i ft ' itb if jl W. it fl'j is ffl at'* -ft ft 
# mj it • 

J: flt it ' ^ IK « # ^ # ^> : ^ftft$i]l^-^i&-£^ 

*H -§P. ^ a*, (external ne t work/ W i de Area Network; WAN ) 
#j #t ijt ; >£. ft ft fifr *1 S£- i& ^ ' £fr & #J ft ft ( h e ad e r ) t • • #. 
% iit AU Jl fa M * ffl it # ft £p ftl ^ ft ; ffij ^ ft *b ^ B£ 

m ssi.-ia £ #j ft sp ft t ' aft to it m A ^ ^ *h # m it ^ ft 

SS- ft 

; s itb > ^ ^ .« # ffl it Ifc"* # M i* * £fr ■& M 6^ # ' 

(peer table)' it ' ^ # #1 *h ^ M it Sfc 

i 

« « 11 H 




i 

5.-- (9) 

i-f l^^itlt^l (peer SPD)« to ft * at : * ff 

j]4 "/£ i #) 4 tS) it A 0 

vT *;M ^ (S30) ; if & * 7t A - « n % A i * (S32) ; m & 

^at If #1 (S34) ; $ 5* m BJW A # m * 4 ti 3? at jfc. 
6<j B*:ft ft >7f L ■ t^itsi'f ( S3 6 ) • a # A ^ 

* ($38): it - ft £1- * *t Jfc 4B 2r- * # #■ ( S 4 o ) • 

3i :bi si * ^ % m n # * a «ft * n - # * ^ i ^ £ i> 

T Wi'-fe : *f # *ft #J ^ (peer identification)- 
to At; (address)- f f 1 (pref ix)f* 35! #J (type) ° 

, jm 4| A A # A*^*! * * #j 

41 #; (pointer)- -fit- At ft W m ft & & & A *b ^ m ft At • 
it i; 4 '1-4 »J -ft * : * tb n fa At t £ '> fa 7t (bit)' t % 

M &\ # m fa At - 3i #J # a- #j i (ri*p***&-£-&^ 

#j ) p e (^ 3p SI- 4t At # #j ) ^ &. b (*&. * t A ) ° «. »i nfr 

«q W ^ JR. 4(IP version 4; IPv4) JM*'J ' *b ■ -*P *I ft fa 

At #i j& ^ If 4 J '14 ft -fc £. ^ 3 2 ; ft 3* *B ft fa & M M M. 

M m #J -h % 'ft S *l ft &r IM 3 2^1 ffi ' «, * IS #1 51- A ']> ffib 

j£ o : ffij ^ -gp >fiL jtt 60 ifr f: 4 'l± -R:^>!i^l^At>fSL7t*tl 13 ° 

; # #1 # # w it n # ^ a ** 5- ^ * a « ¥ 60 f # • ^ 

-fit At ■ - til k ^ ^ ■ ig'J *. * Tf: # ^ M gt.W « ft fa 

*ita.iL^-rt*PiW«»-a«t - . . * -t K t ' *f # «i ^-J ^ .160 # 

i 




I 



i.- &W%LW (10) 

M il! • *b £p ffi 3& -fit *t Rp $ 203.56.77.3 3-»-ft*P 
1 4 0 9 6 . 0 . 0 J. M £ M *t %> 1 6 • ft * * 1 4 0 . 9 6 . 0 . 0£I 14 0. 
9 6.2 5 5.25 5 ° fl' * * # # * «l ** 2tt *T# : M it ' *h *F * * 
#l JaL Sp & 2 0 7.52.79.40' ft £P IB 5£ £ «. * 1 4 0 . 1 1.2 . 0 . 0J. 

# *'iA 4± * 16' ft * «. 14 0.112.0.0$'] 1 40. 1 1 2. 25 5. 2 5 5 ° 
it *h: ' «■ # m M m n W it %> - & & «t * # ffl at ( de 
-fault peer gateway)' # * 4fc & & # it # •*>] # # -W it ^ 

W &\ 4§? jR ft M $L & — -fS^^^-^^atft-*^* ' * ^ 
*1 ^ ; sS, 4f illf fH ' K « # * ^ 1® # # M A 4a - M * 
^ id H ; *t # m * M .it J *f A ^ at 

*h ? 4s x -ffl # at i& ^ ^ f ^ i # * ^^1 ° 

% -\m t ' ^ & #} ^ at ft * * (original SPD)A ^ 
& *fe' # # 2r s£ - flQ4E.£#4a*J-#M**3fc:fc. - ^ * -* # * 
at; Jfc t * £. ' ft*-* A«/»r* ' % n&\ 1# *h 

.# flfll it 4i M -«i * at I- * # : 1* 5 ; A «■ ' # * *J * 2<ft # * 

W i» 4a # 3r at 31 & 2 ^ 3 * Jfc '-4 ; A # # llfc S'J *l Ott # # 

i 

ffl stj 4a M # ^ ^ * * 3 ° - ^ m m * w . 54 6 ^ * 

at! ' ^ *J « - m m. # >5r 3*. ' & m 4 ^ f f ^ 

m ml t # * t ^ * • 

! -f ^. ^ ^ ^ - m & 2t % » -<R # WL # fj 5° *o 
l«|Al^^^it| ' K * 3t ^ # # ^ 8 it 4^ f] it # 

* W m ' ^ '4l 4ft. # * «■ A tt. at * t # * ' rtt # 




i.« ^ffca/l (11) 



:* ft «■# 

* *b ! ' i£ £ it 

it it ^ 

* j&lg> # * 

atj H t *4 * 

«, it # # 

^ — I 1® jfc jit 

- *LI4 4 ft 

i 

- ^ 1*3 ° 

£-i at t * n 
*» • *! -8- TO jt 

it ill & it tTL 

; 1T & A #■ 

* afcj ft # ± & 

HQ ■ » j X fi>j & 
i&j f #t * 

* #l 4fr « A T 

* a| & # # 4£ 
*t -fri a ^ a* 

asfc jfcj f- # >$- ft 

i # «r * 



#r *t at 

it & * 

ft # A 

^ ^ sk. 

- Sfe. #J 

& ( i 
# M it 



ft Bf > It T A I Ig^ ^ ^ t I f # 

T #J * at ft ' M «. JR 
g«»A f >J ft # * #J fl| > f& Ik fr> 

% % ft - ifijJL>&T<ft#&>£&#3r 
at ft * '14 ' * * *fr * ft * *" 

t- %L & & #1 & & & & % & & ) 



# #J ft£ 

# M- 
f t # i 

ft # 

#J *3 2fr 
B ° #■ 
' TO #. 
• at ft 
' 

% ±. 4ft 



at ft ' 
Jl ft # 5*. 
^ ^ ' $ 
4ft (Peer 

#i ft # i. 

at ft #j i% 
tif 4 



^ is] # i^.-s at 
^ at ft f 1 # * 
»J _L a K m 

Host)% b * * ft * 

4f ^ @ # * X X 
^ f i I ti ^ 

4ft * — * 1 
ffi _t i£ #J 3r ^ it 
# ft ^ M it ^ Jak 

it # # ^ a # ^ 
IH9 #> ' & 



% M 

1*3 ^ ^ ffl ° 

4 - 



±lt >flL 

6*J ft 
ft * 



#1 #1 w 

I -5T o 
7t ft ^@ 

« A 4r 

^ * fa 

A 4? ^ 




id- a 

« m\ it m 
m t&; 5t if 

3 SS-i 4r 

ftj &] 3k. 

it *gi s& 

it tfo 1& ^ 
Jfc *T| & 
(S2:02) • 



m & a & 

A T # & 



(12) 

^^^Ir^If > H it it 

fal*}M?%m3&$i%- s ic^M & ' # ^ 

ft I i ^ ' K'J * it it 4£ 5$, ^' ft ° 

a at m ; # ^ t ^ 6d ^ ^ it ^ ^ ^ ^ ^ ^ ^ 

a itj *b 



an 



. ; i^««ii*ifltt-ia^.itfeJt'3a aft. ^ 

W**#^jfc3£il3fc&5£T#ifrft«lfc 
(inbound I PSec packet )^ Sft. ffi 

^^^iimi 3: M ti > -r 5- # # & # & 
;t t£ ( s 1 0 0 ) ; £H & ffl i«3 ft *« it * 

&##^jitf3l4L#.*4fc«: ' fcb *f *r 

#l iit (si 02 ) • # fj # m #j n # ^ ^ 

* a * ' uj ^ * a ^ i'J it I ( s 1 0 8 ) ; 

it m 1& * # & <Hj 

ft (Si 04) » a^fj ft##^6d A'H ; *p 
i>J i^c ft (Sl 06) ; £ *>J ' ft J§fc ft 
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